News › security
By Zayden R., July 19, 2026
A newly discovered flaw in OpenSSL can cause servers to allocate excessive memory with minimal TLS requests. The issue, named HollowByte, highlights the risks of unpatched systems and the importance of vigilant updates.
A subtle yet impactful flaw in OpenSSL, dubbed 'HollowByte,' has been revealed by Okta's Red Team, showcasing how an unpatched server can be manipulated to allocate significant memory using just an eleven-byte TLS request. This vulnerability, while lacking a formal CVE designation or advisory, underscores the potential risks lurking in widely-used libraries when updates are overlooked.
The HollowByte flaw was quietly addressed by OpenSSL in June, yet without any changelog entry to flag the fix, it largely flew under the radar. The vulnerability allows an attacker to force an affected server to set aside up to 131 KB of memory for a message that never fully materializes, effectively causing a denial-of-service condition. On systems utilizing glibc, such as those tested by Okta, this memory remains unavailable until the process is restarted, potentially crippling server operations.
For sysadmins and developers, this highlights the ever-present need for diligence in applying updates, even those that might not initially appear critical. The lack of a formal advisory accompanying the fix suggests a gap in communication that could leave many systems exposed longer than necessary. While the impact might seem minimal at first glance, in high-traffic environments, the cumulative effect could be significant.
The discovery of HollowByte serves as a reminder of the intricate dependencies within software ecosystems and the importance of maintaining a proactive stance on security patches. As OpenSSL remains a cornerstone of secure communications, ensuring its integrity is paramount.